Mapping Device Identifiers

1. A system comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the system to perform: obtaining first service event information, the first service event information identifying a first set of device identifiers of a first set of devices using a first service, a first set of timestamps associated with the first set of devices, and a first set of addresses associated with the first set of devices; obtaining second service event information, the second service event information identifying a second set of device identifiers of a second set of devices using a second service, a second set of timestamps associated with the second set of devices, and a second set of addresses associated with the second set of devices; identifying a timestamp and an address of a device of the first set of devices based on the first service event information; determining a time window based on the timestamp, a type of the first service or a type of the second service, and an expected duration of use of the type of the first service or the type of the second service; and identifying one or more device identifiers of the second set of devices based on a comparison of the address with addresses of the second set of addresses that are associated with timestamps within the time window.

2. The system of claim 1 , wherein the first set of device identifiers are of a different type than the second set of device identifier.

3. The system of claim 2 , wherein the first set of device identifiers are determined based on a first fingerprinting service and the second set of device identifier are determined based on a second fingerprinting service different from the first fingerprinting service.

4. The system of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the system to perform mapping a device of the second set of devices to the device of the first set of devices.

5. The system of claim 4 , wherein the mapping of the device of the second set of devices to the device of the first set of devices is used to associate an analysis of the device of the first set of devices with the device of the second set of devices.

6. The system of claim 4 , wherein the mapping of the device of the second set of devices to the device of the first set of devices is performed based on a frequency of the identification of the one or more device identifiers of the second set of devices.

7. The system of claim 6 , wherein the mapping of the device of the second set of devices to the device of the first set of devices is performed further based on a confidence level.

8. The system of claim 1 , wherein the identifying a device identifier further comprises: identifying a second timestamp and a second address of the device of the first set of devices based on the first service event information, the second timestamp indicating a time at which the device logged into the first service, utilized a function of the first service, or logged off from the first service; determining a second time window based on the second timestamp; determining, from the second set of devices, a second device identifier in which corresponding one or more addresses have a highest combined number of matches with the address within the time window or with the second address within the second time window, compared to other device identifiers from the second set of devices; and mapping, to the device, a second device corresponding to the determined second device identifier.

9. The system of claim 1 , wherein the instructions, when executed, further cause the one or more processors to perform blocking activities of a device corresponding to the identified one or more device identifiers of the second set of devices.

10. A method implemented by a computing system including one or more processors and storage media storing machine-readable instructions, wherein the method is performed using the one or more processors, the method comprising: obtaining first service event information, the first service event information identifying a first set of device identifiers of a first set of devices using a first service, a first set of timestamps associated with the first set of devices, and a first set of addresses associated with the first set of devices; obtaining second service event information, the second service event information identifying a second set of device identifiers of a second set of devices using a second service, a second set of timestamps associated with the second set of devices, and a second set of addresses associated with the second set of devices; identifying a timestamp and an address of a device of the first set of devices based on the first service event information; determining a time window based on the timestamp, a type of the first service or a type of the second service, and an expected duration of use of the type of the first service or the type of the second service; and identifying one or more device identifiers of the second set of devices based on a comparison of the address with addresses of the second set of addresses that are associated with timestamps within the time window.

11. The method of claim 10 , wherein the first set of device identifiers are of a different type than the second set of device identifier.

12. The method of claim 11 , wherein the first set of device identifiers are determined based on a first fingerprinting service and the second set of device identifier are determined based on a second fingerprinting service different from the first fingerprinting service.

13. The method of claim 10 , wherein the instructions, when executed, further cause the one or more processors to perform mapping a device of the second set of devices to the device of the first set of devices to associate an analysis of the device of the first set of devices with the device of the second set of devices.

14. The method of claim 10 , wherein the instructions, when executed, further cause the one or more processors to perform mapping a device of the second set of devices to the device of the first set of devices based on a frequency of the identification of the one or more device identifiers of the second set of devices.

15. The method of claim 14 , wherein the mapping of the device of the second set of devices to the device of the first set of devices is performed further based on a confidence level.

16. A non-transitory computer readable medium comprising instructions that, when executed, cause one or more processors to perform: obtaining first service event information, the first service event information identifying a first set of device identifiers of a first set of devices using a first service, a first set of timestamps associated with the first set of devices, and a first set of addresses associated with the first set of devices; obtaining second service event information, the second service event information identifying a second set of device identifiers of a second set of devices using a second service, a second set of timestamps associated with the second set of devices, and a second set of addresses associated with the second set of devices; identifying a timestamp and an address of a device of the first set of devices based on the first service event information; determining a time window based on the timestamp, a type of the first service or a type of the second service, and an expected duration of use of the type of the first service or the type of the second service; and identifying one or more device identifiers of the second set of devices based on a comparison of the address with addresses of the second set of addresses that are associated with timestamps within the time window.

17. The non-transitory computer readable medium of claim 16 , wherein the first set of device identifiers are of a different type than the second set of device identifier.

18. The non-transitory computer readable medium of claim 17 , wherein the first set of device identifiers are determined based on a first fingerprinting service and the second set of device identifier are determined based on a second fingerprinting service different from the first fingerprinting service.

19. The non-transitory computer readable medium of claim 16 , wherein the instructions, when executed, further cause the one or more processors to perform mapping a device of the second set of devices to the device of the first set of devices to associate an analysis of the device of the first set of devices with the device of the second set of devices.

20. The non-transitory computer readable medium of claim 16 , wherein the instructions, when executed, further cause the one or more processors to perform mapping a device of the second set of devices to the device based on a frequency of the identification of the one or more device identifiers of the second set of devices.